# Keycloak 24.0.5 released

DevFeed: [Keycloak 24.0.5 released](<https://devfeed.tech/articles/keycloak-24-0-5-released-31643.md>)

Original publisher: [Read original article](<https://www.keycloak.org/2024/06/keycloak-2405-released>)

Author: Keycloak Team

Published: 2024-06-04T00:00:00Z

Content type: release

Language: en

Sources: [Keycloak Blog](<https://devfeed.tech/sources/keycloak-blog.md>)

Topics: [Keycloak](<https://devfeed.tech/topics/keycloak.md>), [OpenID connect (OIDC)](<https://devfeed.tech/topics/oidc.md>), [Security](<https://devfeed.tech/topics/security.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [LDAP](<https://devfeed.tech/topics/ldap.md>), [Cypress](<https://devfeed.tech/topics/cypress.md>), [Maven](<https://devfeed.tech/topics/maven.md>)

Tags: [authentication](<https://devfeed.tech/tags/authentication.md>), [bugs](<https://devfeed.tech/tags/bugs.md>), [client](<https://devfeed.tech/tags/client.md>), [cypress](<https://devfeed.tech/tags/cypress.md>), [idm](<https://devfeed.tech/tags/idm.md>), [kerberos](<https://devfeed.tech/tags/kerberos.md>), [keycloak](<https://devfeed.tech/tags/keycloak.md>), [keycloak-release](<https://devfeed.tech/tags/keycloak-release.md>), [ldap](<https://devfeed.tech/tags/ldap.md>), [maven](<https://devfeed.tech/tags/maven.md>), [migration](<https://devfeed.tech/tags/migration.md>), [openid-connect](<https://devfeed.tech/tags/openid-connect.md>), [release](<https://devfeed.tech/tags/release.md>), [saml](<https://devfeed.tech/tags/saml.md>), [security](<https://devfeed.tech/tags/security.md>), [sso](<https://devfeed.tech/tags/sso.md>)

## AI overview

Keycloak 24.0.5 is released with a fix for a security issue affecting some OIDC confidential clients using PAR with client_secret_post authentication. Users of this configuration are encouraged to rotate client secrets after upgrading. The release also includes enhancements, migration guidance, and resolved bugs.

## Source excerpt

To download the release go to Keycloak downloads. Highlights Security issue with PAR clients using client_secret_post based authentication This release contains the fix of the important security issue affecting some OIDC confidential clients using PAR (Pushed authorization request). In case you use OIDC confidential clients together with PAR and you use client authentication based on client_id and client_secret sent as parameters in the HTTP request body (method client_secret_post specified in the OIDC specification), it is highly encouraged to rotate the client secrets of your clients after upgrading to this version. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Enhancements #29073 Use cache.compute() method to improve the replace retry loop #29280 Update Create Realm in Keycloak 24 Getting Started Bugs #29129 JGroups creates log messages as it switched internally to "trace" dist/quarkus #29206 LDAP user creation reports error but user is created ldap #29314 Clicking the "save" button multiple times in the Saml IDP configuration page corrupts the value of "AuthnContext ClassRefs" admin/ui #29458 Empty CSP header value breaks security filter authentication #29471 Cypress tests store videos even for passing tests ci #29525 Maven clean build doesn't clean admin client generated files ci #29554 Cypress failing on video recording ci #29625 Database driver install examples can lead to permission errors in some circumstances docs